Straszne spowolnienie kompa, win32/sality.naj

[Decoy]

Zamieszczam log

Kod: Zaznacz wszystko

OTS logfile created on: 2010-02-14 20:13:00 - Run 1
OTS by OldTimer - Version 3.1.20.1     Folder = C:\Documents and Settings\Admin\Pulpit
Windows XP Home Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 65,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 6,87 Gb Free Space | 14,07% Space Free | Partition Type: NTFS
Drive D: | 184,05 Gb Total Space | 33,44 Gb Free Space | 18,17% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
Drive F: | 298,09 Gb Total Space | 3,49 Gb Free Space | 1,17% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: BLACKDEVIL
Current User Name: Admin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days

[Processes - Safe List]
ots.exe -> C:\Documents and Settings\Admin\Pulpit\OTS.exe -> [2010-02-14 20:11:25 | 000,632,320 | ---- | M] (OldTimer Tools)
explorer.exe -> C:\WINDOWS\explorer.exe -> [2010-02-12 17:22:38 | 001,035,264 | ---- | M] (Microsoft Corporation)
pnkbstrb.exe -> C:\WINDOWS\system32\PnkBstrB.exe -> [2010-02-06 12:52:24 | 000,214,520 | ---- | M] ()
pnkbstra.exe -> C:\WINDOWS\system32\PnkBstrA.exe -> [2009-12-30 23:18:39 | 000,075,064 | ---- | M] ()
jqs.exe -> C:\Program Files\Java\jre6\bin\jqs.exe -> [2009-12-19 20:46:51 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.)
jusched.exe -> C:\Program Files\Java\jre6\bin\jusched.exe -> [2009-12-19 20:46:51 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.)
opera.exe -> C:\Program Files\Opera\opera.exe -> [2009-11-20 19:01:18 | 000,832,296 | ---- | M] (Opera Software)
aqq.exe -> C:\Program Files\WapSter\WapSter AQQ\AQQ.exe -> [2009-11-17 15:18:22 | 006,828,032 | ---- | M] ()
ekrn.exe -> C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -> [2009-11-16 09:04:30 | 000,735,960 | ---- | M] (ESET)
egui.exe -> C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe -> [2009-11-16 09:03:32 | 002,054,360 | ---- | M] (ESET)
dtlite.exe -> C:\Program Files\DAEMON Tools Lite\DTLite.exe -> [2009-10-30 12:57:08 | 000,369,200 | ---- | M] (DT Soft Ltd)
nbhregincdsrv.exe -> C:\Program Files\Nero\Tools\InCD\NBHRegInCDSrv.exe -> [2009-10-16 10:44:18 | 000,053,560 | ---- | M] (Nero AG)
incdsrv.exe -> C:\Program Files\Nero\Tools\InCD\InCDSrv.exe -> [2009-10-16 10:44:10 | 001,420,592 | ---- | M] (Nero AG)
ati2evxx.exe -> C:\WINDOWS\system32\ati2evxx.exe -> [2008-06-24 14:58:41 | 000,557,056 | ---- | M] (ATI Technologies Inc.)
rthdcpl.exe -> C:\WINDOWS\RTHDCPL.exe -> [2008-02-13 07:31:34 | 016,857,600 | R--- | M] (Realtek Semiconductor Corp.)
mom.exe -> C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe -> [2007-07-17 11:13:56 | 000,049,152 | ---- | M] (Advanced Micro Devices Inc.)
ccc.exe -> C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe -> [2007-07-17 11:13:34 | 000,049,152 | ---- | M] (ATI Technologies Inc.)
dragdiag.exe -> C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe -> [2004-08-06 09:45:04 | 000,877,568 | ---- | M] (THOMSON Telecom Belgium)

[Modules - Safe List]
ots.exe -> C:\Documents and Settings\Admin\Pulpit\OTS.exe -> [2010-02-14 20:11:25 | 000,632,320 | ---- | M] (OldTimer Tools)

[Win32 Services - Safe List]
(IDriverT) InstallDriver Table Manager [On_Demand | Stopped] -> C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -> [2010-02-12 17:22:51 | 000,069,632 | ---- | M] (Macrovision Corporation)
(DAUpdaterSvc) Dragon Age: Początek - Aktualizator zawartości [On_Demand | Stopped] -> D:\gry\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe -> [2010-02-12 17:22:49 | 000,020,480 | ---- | M] (BioWare)
(PnkBstrB) PnkBstrB [Auto | Running] -> C:\WINDOWS\system32\PnkBstrB.exe -> [2010-02-06 12:52:24 | 000,214,520 | ---- | M] ()
(PnkBstrA) PnkBstrA [Auto | Running] -> C:\WINDOWS\system32\PnkBstrA.exe -> [2009-12-30 23:18:39 | 000,075,064 | ---- | M] ()
(JavaQuickStarterService) Java Quick Starter [Auto | Running] -> C:\Program Files\Java\jre6\bin\jqs.exe -> [2009-12-19 20:46:51 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.)
(FLEXnet Licensing Service) FLEXnet Licensing Service [On_Demand | Stopped] -> C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -> [2009-11-24 22:19:47 | 000,655,624 | ---- | M] (Acresso Software Inc.)
(EHttpSrv) ESET HTTP Server [On_Demand | Stopped] -> C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -> [2009-11-16 09:12:54 | 000,020,680 | ---- | M] (ESET)
(ekrn) ESET Service [Auto | Running] -> C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -> [2009-11-16 09:04:30 | 000,735,960 | ---- | M] (ESET)
(NeroRegInCDSrv) Nero Registry InCD Service [Auto | Running] -> C:\Program Files\Nero\Tools\InCD\NBHRegInCDSrv.exe -> [2009-10-16 10:44:18 | 000,053,560 | ---- | M] (Nero AG)
(InCDSrv) InCD Helper [Auto | Running] -> C:\Program Files\Nero\Tools\InCD\InCDSrv.exe -> [2009-10-16 10:44:10 | 001,420,592 | ---- | M] (Nero AG)
(Ati HotKey Poller) Ati HotKey Poller [Auto | Running] -> C:\WINDOWS\system32\ati2evxx.exe -> [2008-06-24 14:58:41 | 000,557,056 | ---- | M] (ATI Technologies Inc.)
(Pml Driver HPZ12) Pml Driver HPZ12 [On_Demand | Stopped] -> C:\WINDOWS\system32\hpzipm12.exe -> [2002-08-01 10:22:40 | 000,065,536 | ---- | M] (HP)

[Driver Services - Safe List]
(atksgt) atksgt [Kernel | Auto | Running] -> C:\WINDOWS\system32\drivers\atksgt.sys -> [2009-12-06 18:07:34 | 000,281,760 | ---- | M] ()
(lirsgt) lirsgt [Kernel | Auto | Running] -> C:\WINDOWS\system32\drivers\lirsgt.sys -> [2009-12-06 18:07:34 | 000,025,888 | ---- | M] ()
(sptd) sptd [Kernel | Boot | Running] -> C:\WINDOWS\System32\Drivers\sptd.sys -> [2009-11-21 15:39:39 | 000,691,696 | ---- | M] ()
(gdrv) gdrv [Kernel | On_Demand | Stopped] -> C:\WINDOWS\gdrv.sys -> [2009-11-21 13:50:06 | 000,016,608 | ---- | M] (Windows (R) 2000 DDK provider)
(epfwtdir) epfwtdir [Kernel | System | Running] -> C:\WINDOWS\system32\drivers\epfwtdir.sys -> [2009-11-16 09:06:50 | 000,096,408 | ---- | M] (ESET)
(ehdrv) ehdrv [Kernel | System | Running] -> C:\WINDOWS\system32\drivers\ehdrv.sys -> [2009-11-16 09:03:36 | 000,108,792 | ---- | M] (ESET)
(eamon) eamon [File_System | Auto | Running] -> C:\WINDOWS\system32\drivers\eamon.sys -> [2009-11-16 08:56:12 | 000,116,520 | ---- | M] (ESET)
(InCDFs) Nero UDF File System Driver [File_System | On_Demand | Running] -> C:\WINDOWS\system32\drivers\InCDFs.sys -> [2009-10-16 10:43:04 | 000,130,200 | ---- | M] (Nero AG)
(InCDRec) Nero UDF File System Recognizer Driver [File_System | System | Running] -> C:\WINDOWS\system32\drivers\InCDRec.sys -> [2009-10-16 10:42:58 | 000,019,096 | ---- | M] (Nero AG)
(InCDPass) Nero InCDPass Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\InCDPass.sys -> [2009-10-16 10:42:50 | 000,048,280 | ---- | M] (Nero AG)
(adfs) adfs [Kernel | Auto | Running] -> C:\WINDOWS\system32\drivers\adfs.sys -> [2008-08-14 07:57:42 | 000,074,720 | ---- | M] (Adobe Systems, Inc.)
(ati2mtag) ati2mtag [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\ati2mtag.sys -> [2008-06-24 15:52:46 | 003,229,696 | ---- | M] (ATI Technologies Inc.)
(AtiHdmiService) ATI Function Driver for HDMI Service [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\AtiHdmi.sys -> [2008-05-20 12:53:36 | 000,093,696 | R--- | M] (ATI Research Inc.)
(HDAudBus) Sterownik magistrali Microsoft UAA dla High Definition Audio [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\hdaudbus.sys -> [2008-04-15 13:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider)
(Secdrv) Secdrv [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\secdrv.sys -> [2008-04-15 13:00:00 | 000,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
(Ptilink) Sterownik bezpośredniego połączenia kablowego [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\ptilink.sys -> [2008-04-15 13:00:00 | 000,017,792 | ---- | M] (Parallel Technologies, Inc.)
(IntcAzAudAddService) Service for Realtek HD Audio (WDM) [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\RtkHDAud.sys -> [2008-02-14 10:04:06 | 004,676,096 | R--- | M] (Realtek Semiconductor Corp.)
(alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\alcan5wn.sys -> [2003-12-08 12:53:48 | 000,053,600 | ---- | M] (THOMSON)
(alcaudsl) SpeedTouch ADSL Modem ATM Transport [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\alcaudsl.sys -> [2003-12-08 12:53:46 | 000,070,688 | ---- | M] (THOMSON)


[Files/Folders - Created Within 30 Days]
OTS.exe -> C:\Documents and Settings\Admin\Pulpit\OTS.exe -> [2010-02-14 20:11:25 | 000,632,320 | ---- | C] (OldTimer Tools)
LastGood -> C:\WINDOWS\LastGood -> [2010-02-14 20:00:40 | 000,000,000 | ---D | C]
ESET -> C:\Program Files\ESET -> [2010-02-14 20:00:20 | 000,000,000 | ---D | C]
Kaspersky Lab Setup Files -> C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files -> [2010-02-12 17:14:44 | 000,000,000 | ---D | C]
Port Royale -> C:\Program Files\Port Royale -> [2010-02-01 14:25:37 | 000,000,000 | ---D | C]
100CANON -> C:\Documents and Settings\Admin\Pulpit\100CANON -> [2010-01-29 22:46:23 | 000,000,000 | ---D | C]
I-bot ocx files fix -> C:\Program Files\I-bot ocx files fix -> [2010-01-29 12:29:06 | 000,000,000 | ---D | C]
edxLabs -> C:\Documents and Settings\Admin\Dane aplikacji\edxLabs -> [2010-01-28 14:53:02 | 000,000,000 | ---D | C]
Thinstall -> C:\Documents and Settings\Admin\Dane aplikacji\Thinstall -> [2010-01-24 17:12:34 | 000,000,000 | ---D | C]
YouTube Downloader -> C:\Program Files\YouTube Downloader -> [2010-01-19 22:54:59 | 000,000,000 | ---D | C]
InstallShield Installation Information -> C:\Documents and Settings\Admin\Dane aplikacji\InstallShield Installation Information -> [2010-01-18 14:51:00 | 000,000,000 | ---D | C]
TABCTL32.OCX -> C:\WINDOWS\System32\TABCTL32.OCX -> [2010-01-17 11:57:30 | 000,209,608 | ---- | C] (Microsoft Corporation)
Codejock.CommandBars.Unicode.v12.1.1.ocx -> C:\WINDOWS\System32\Codejock.CommandBars.Unicode.v12.1.1.ocx -> [2010-01-17 11:57:29 | 002,271,152 | ---- | C] (Codejock Software)
MSWINSCK.OCX -> C:\WINDOWS\System32\MSWINSCK.OCX -> [2010-01-17 11:57:29 | 000,109,248 | ---- | C] (Microsoft Corporation)
Codejock.Controls.v12.1.1.ocx -> C:\WINDOWS\System32\Codejock.Controls.v12.1.1.ocx -> [2010-01-17 11:57:27 | 001,779,632 | ---- | C] (Codejock Software)
CoD RconTool -> C:\Program Files\CoD RconTool -> [2010-01-17 11:57:26 | 000,000,000 | ---D | C]
AskToolbar -> C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\AskToolbar -> [2010-01-17 11:38:53 | 000,000,000 | ---D | C]
Skype -> C:\Documents and Settings\Admin\Dane aplikacji\Skype -> [2010-01-16 19:55:06 | 000,000,000 | ---D | C]
Skype -> C:\Program Files\Common Files\Skype -> [2010-01-16 19:54:42 | 000,000,000 | ---D | C]
Skype -> C:\Program Files\Skype -> [2010-01-16 19:54:39 | 000,000,000 | R--D | C]
Skype -> C:\Documents and Settings\All Users\Dane aplikacji\Skype -> [2010-01-16 19:54:35 | 000,000,000 | ---D | C]
Xfire -> C:\Documents and Settings\NetworkService\Dane aplikacji\Xfire -> [2010-01-06 18:46:55 | 000,000,000 | ---D | M]
ESET -> C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\ESET -> [2009-11-21 14:50:11 | 000,000,000 | ---D | M]
Microsoft -> C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft -> [2009-11-21 13:40:50 | 000,000,000 | ---D | M]
Microsoft -> C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft -> [2009-11-21 13:40:14 | 000,000,000 | ---D | M]
Microsoft -> C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft -> [2009-11-21 13:38:24 | 000,000,000 | --SD | M]
Microsoft -> C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft -> [2009-11-21 13:38:24 | 000,000,000 | --SD | M]
3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp ->
3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp ->
1 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp ->

[Files/Folders - Modified Within 30 Days]
OTS.exe -> C:\Documents and Settings\Admin\Pulpit\OTS.exe -> [2010-02-14 20:11:25 | 000,632,320 | ---- | M] (OldTimer Tools)
{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job -> C:\WINDOWS\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job -> [2010-02-14 20:05:00 | 000,000,278 | -H-- | M] ()
Scheduled Update for Ask Toolbar.job -> C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job -> [2010-02-14 20:01:00 | 000,000,234 | ---- | M] ()
{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job -> C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job -> [2010-02-14 19:56:00 | 000,000,240 | -H-- | M] ()
system.ini -> C:\WINDOWS\system.ini -> [2010-02-14 19:10:23 | 000,000,290 | ---- | M] ()
vcmgcd32.dl_ -> C:\WINDOWS\System32\vcmgcd32.dl_ -> [2010-02-14 19:01:00 | 000,017,878 | -H-- | M] ()
PerfStringBackup.INI -> C:\WINDOWS\System32\PerfStringBackup.INI -> [2010-02-14 14:40:04 | 001,087,636 | ---- | M] ()
perfh015.dat -> C:\WINDOWS\System32\perfh015.dat -> [2010-02-14 14:40:04 | 000,490,284 | ---- | M] ()
perfh009.dat -> C:\WINDOWS\System32\perfh009.dat -> [2010-02-14 14:40:04 | 000,432,356 | ---- | M] ()
perfc015.dat -> C:\WINDOWS\System32\perfc015.dat -> [2010-02-14 14:40:04 | 000,083,660 | ---- | M] ()
perfc009.dat -> C:\WINDOWS\System32\perfc009.dat -> [2010-02-14 14:40:04 | 000,067,312 | ---- | M] ()
SA.DAT -> C:\WINDOWS\tasks\SA.DAT -> [2010-02-14 14:36:02 | 000,000,006 | -H-- | M] ()
bootstat.dat -> C:\WINDOWS\bootstat.dat -> [2010-02-14 14:35:53 | 000,002,048 | --S- | M] ()
NTUSER.DAT -> C:\Documents and Settings\Admin\NTUSER.DAT -> [2010-02-14 13:39:35 | 003,932,160 | -H-- | M] ()
ntuser.ini -> C:\Documents and Settings\Admin\ntuser.ini -> [2010-02-14 13:39:35 | 000,000,188 | -HS- | M] ()
eav_nt32_plk.msi -> C:\Documents and Settings\Admin\Pulpit\eav_nt32_plk.msi -> [2010-02-14 12:07:00 | 034,372,096 | ---- | M] ()
pictures_longcat.jpg -> C:\Documents and Settings\Admin\Pulpit\pictures_longcat.jpg -> [2010-02-13 22:12:19 | 000,874,355 | ---- | M] ()
AIMP2.lnk -> C:\Documents and Settings\Admin\Pulpit\AIMP2.lnk -> [2010-02-13 18:03:20 | 000,000,659 | ---- | M] ()
alcwzrd.exe -> C:\WINDOWS\alcwzrd.exe -> [2010-02-12 17:59:58 | 002,808,832 | R--- | M] (RealTek Semicoductor Corp.)
NCUNINST.EXE -> C:\WINDOWS\NCUNINST.EXE -> [2010-02-12 17:59:58 | 000,045,056 | ---- | M] (Northern Codeworks)
AQQ.lnk -> C:\Documents and Settings\Admin\Pulpit\AQQ.lnk -> [2010-02-12 17:32:09 | 000,000,779 | ---- | M] ()
userini.exe -> C:\WINDOWS\System32\userini.exe -> [2010-02-12 17:24:03 | 000,028,672 | ---- | M] ()
ieudinit.exe -> C:\WINDOWS\System32\ieudinit.exe -> [2010-02-12 17:22:52 | 000,013,824 | ---- | M] (Microsoft Corporation)
explorer.exe -> C:\WINDOWS\explorer.exe -> [2010-02-12 17:22:38 | 001,035,264 | ---- | M] (Microsoft Corporation)
ie4uinit.exe -> C:\WINDOWS\System32\dllcache\ie4uinit.exe -> [2010-02-12 17:20:50 | 000,070,656 | ---- | M] (Microsoft Corporation)
ie4uinit.exe -> C:\WINDOWS\System32\ie4uinit.exe -> [2010-02-12 17:20:41 | 000,070,656 | ---- | M] (Microsoft Corporation)
aaa.jpg -> C:\Documents and Settings\Admin\Pulpit\aaa.jpg -> [2010-02-12 16:51:13 | 000,098,313 | ---- | M] ()
strzegomskie-kurewki-zwierzenia.wmv -> C:\Documents and Settings\Admin\Pulpit\strzegomskie-kurewki-zwierzenia.wmv -> [2010-02-11 16:50:00 | 021,390,666 | ---- | M] ()
jinsi.zip -> C:\Documents and Settings\Admin\Pulpit\jinsi.zip -> [2010-02-10 21:31:26 | 026,476,031 | ---- | M] ()
Loader.lnk -> C:\Documents and Settings\Admin\Pulpit\Loader.lnk -> [2010-02-10 21:28:35 | 000,000,568 | ---- | M] ()
iBot.lnk -> C:\Documents and Settings\Admin\Pulpit\iBot.lnk -> [2010-02-10 21:24:48 | 000,000,474 | ---- | M] ()
Silkroad.lnk -> C:\Documents and Settings\Admin\Pulpit\Silkroad.lnk -> [2010-02-10 21:23:42 | 000,000,518 | ---- | M] ()
DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> [2010-02-10 20:35:04 | 000,015,360 | ---- | M] ()
imsins.BAK -> C:\WINDOWS\imsins.BAK -> [2010-02-10 19:09:04 | 000,001,374 | ---- | M] ()
MRT.INI -> C:\WINDOWS\System32\MRT.INI -> [2010-02-10 19:09:01 | 000,000,118 | ---- | M] ()
wpa.dbl -> C:\WINDOWS\System32\wpa.dbl -> [2010-02-10 18:32:16 | 000,013,646 | ---- | M] ()
Airfix Dogfighter.lnk -> C:\Documents and Settings\Admin\Pulpit\Airfix Dogfighter.lnk -> [2010-02-08 16:34:21 | 000,000,467 | ---- | M] ()
Bogusz.pit -> C:\Documents and Settings\Admin\Moje dokumenty\Bogusz.pit -> [2010-02-07 10:59:22 | 000,021,345 | ---- | M] ()
PnkBstrK.sys -> C:\WINDOWS\System32\drivers\PnkBstrK.sys -> [2010-02-06 12:52:52 | 000,137,464 | ---- | M] ()
PnkBstrB.xtr -> C:\WINDOWS\System32\PnkBstrB.xtr -> [2010-02-06 12:52:24 | 000,214,520 | ---- | M] ()
PnkBstrB.exe -> C:\WINDOWS\System32\PnkBstrB.exe -> [2010-02-06 12:52:24 | 000,214,520 | ---- | M] ()
1265397233_by_AdventRebel_500.jpg -> C:\Documents and Settings\Admin\Pulpit\1265397233_by_AdventRebel_500.jpg -> [2010-02-05 20:16:07 | 000,035,558 | ---- | M] ()
om nom nom nom.jpg -> C:\Documents and Settings\Admin\Pulpit\om nom nom nom.jpg -> [2010-02-05 20:12:14 | 000,033,575 | ---- | M] ()
Surrogates.avi -> C:\Documents and Settings\Admin\Pulpit\Surrogates.avi -> [2010-02-02 21:58:00 | 732,948,480 | ---- | M] ()
FLORIAN.pit -> C:\Documents and Settings\Admin\Moje dokumenty\FLORIAN.pit -> [2010-02-02 15:14:53 | 000,028,482 | ---- | M] ()
Port Royale.lnk -> C:\Documents and Settings\Admin\Pulpit\Port Royale.lnk -> [2010-02-01 14:27:21 | 000,001,564 | ---- | M] ()
raf.pit -> C:\Documents and Settings\Admin\Moje dokumenty\raf.pit -> [2010-01-31 14:43:31 | 000,031,135 | ---- | M] ()
tut.JPG -> C:\Documents and Settings\Admin\Pulpit\tut.JPG -> [2010-01-29 15:09:19 | 000,379,752 | ---- | M] ()
RISEN_Mini_MaDBoT.lnk -> C:\Documents and Settings\Admin\Pulpit\RISEN_Mini_MaDBoT.lnk -> [2010-01-26 12:15:53 | 000,000,822 | ---- | M] ()
CoD RconTool.lnk -> C:\Documents and Settings\Admin\Pulpit\CoD RconTool.lnk -> [2010-01-22 22:30:19 | 000,001,617 | ---- | M] ()
xfcodec.dll -> C:\WINDOWS\System32\xfcodec.dll -> [2010-01-22 02:33:06 | 000,041,872 | ---- | M] ()
CmdLineExt.dll -> C:\WINDOWS\System32\CmdLineExt.dll -> [2010-01-21 12:33:45 | 000,107,888 | ---- | M] (Sony DADC Austria AG.)
Crysis Warhead.lnk -> C:\Documents and Settings\Admin\Pulpit\Crysis Warhead.lnk -> [2010-01-21 12:33:07 | 000,000,652 | ---- | M] ()
YouTube Downloader.lnk -> C:\Documents and Settings\Admin\Pulpit\YouTube Downloader.lnk -> [2010-01-19 22:54:59 | 000,000,804 | ---- | M] ()
Fallout Mod Manager.lnk -> C:\Documents and Settings\Admin\Pulpit\Fallout Mod Manager.lnk -> [2010-01-18 15:10:36 | 000,000,928 | ---- | M] ()
Skype.lnk -> C:\Documents and Settings\All Users\Pulpit\Skype.lnk -> [2010-01-16 19:54:42 | 000,001,880 | ---- | M] ()
7 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp ->
3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp ->
3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp ->
187 C:\Documents and Settings\Admin\Ustawienia lokalne\Temp\*.tmp files -> C:\Documents and Settings\Admin\Ustawienia lokalne\Temp\*.tmp ->
187 C:\Documents and Settings\Admin\Ustawienia lokalne\Temp\*.tmp files -> C:\Documents and Settings\Admin\Ustawienia lokalne\Temp\*.tmp ->
187 C:\Documents and Settings\Admin\Ustawienia lokalne\Temp\*.tmp files -> C:\Documents and Settings\Admin\Ustawienia lokalne\Temp\*.tmp ->
1 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp ->

[Files - No Company Name]
eav_nt32_plk.msi -> C:\Documents and Settings\Admin\Pulpit\eav_nt32_plk.msi -> [2010-02-14 12:04:07 | 034,372,096 | ---- | C] ()
pictures_longcat.jpg -> C:\Documents and Settings\Admin\Pulpit\pictures_longcat.jpg -> [2010-02-13 22:12:19 | 000,874,355 | ---- | C] ()
aaa.jpg -> C:\Documents and Settings\Admin\Pulpit\aaa.jpg -> [2010-02-12 14:50:27 | 000,098,313 | ---- | C] ()
userini.exe -> C:\WINDOWS\System32\userini.exe -> [2010-02-11 21:36:04 | 000,028,672 | ---- | C] ()
strzegomskie-kurewki-zwierzenia.wmv -> C:\Documents and Settings\Admin\Pulpit\strzegomskie-kurewki-zwierzenia.wmv -> [2010-02-11 16:46:10 | 021,390,666 | ---- | C] ()
jinsi.zip -> C:\Documents and Settings\Admin\Pulpit\jinsi.zip -> [2010-02-10 21:27:00 | 026,476,031 | ---- | C] ()
iBot.lnk -> C:\Documents and Settings\Admin\Pulpit\iBot.lnk -> [2010-02-10 21:24:49 | 000,000,474 | ---- | C] ()
Loader.lnk -> C:\Documents and Settings\Admin\Pulpit\Loader.lnk -> [2010-02-10 21:24:44 | 000,000,568 | ---- | C] ()
the kingdom pl.avi -> C:\Documents and Settings\Admin\Pulpit\the kingdom pl.avi -> [2010-02-08 19:58:08 | 733,898,752 | ---- | C] ()
Surrogates.avi -> C:\Documents and Settings\Admin\Pulpit\Surrogates.avi -> [2010-02-08 19:57:48 | 732,948,480 | ---- | C] ()
Airfix Dogfighter.lnk -> C:\Documents and Settings\Admin\Pulpit\Airfix Dogfighter.lnk -> [2010-02-08 16:34:21 | 000,000,467 | ---- | C] ()
Bogusz.pit -> C:\Documents and Settings\Admin\Moje dokumenty\Bogusz.pit -> [2010-02-07 10:59:22 | 000,021,345 | ---- | C] ()
1265397233_by_AdventRebel_500.jpg -> C:\Documents and Settings\Admin\Pulpit\1265397233_by_AdventRebel_500.jpg -> [2010-02-05 20:16:07 | 000,035,558 | ---- | C] ()
om nom nom nom.jpg -> C:\Documents and Settings\Admin\Pulpit\om nom nom nom.jpg -> [2010-02-05 20:12:14 | 000,033,575 | ---- | C] ()
Port Royale.lnk -> C:\Documents and Settings\Admin\Pulpit\Port Royale.lnk -> [2010-02-01 14:27:21 | 000,001,564 | ---- | C] ()
FLORIAN.pit -> C:\Documents and Settings\Admin\Moje dokumenty\FLORIAN.pit -> [2010-01-31 14:52:31 | 000,028,482 | ---- | C] ()
raf.pit -> C:\Documents and Settings\Admin\Moje dokumenty\raf.pit -> [2010-01-31 14:43:31 | 000,031,135 | ---- | C] ()
tut.JPG -> C:\Documents and Settings\Admin\Pulpit\tut.JPG -> [2010-01-29 15:09:19 | 000,379,752 | ---- | C] ()
RISEN_Mini_MaDBoT.lnk -> C:\Documents and Settings\Admin\Pulpit\RISEN_Mini_MaDBoT.lnk -> [2010-01-26 12:15:54 | 000,000,822 | ---- | C] ()
Silkroad.lnk -> C:\Documents and Settings\Admin\Pulpit\Silkroad.lnk -> [2010-01-25 18:02:34 | 000,000,518 | ---- | C] ()
SilkroadOnline_GlobalOfficial_v1_225.exe -> C:\Documents and Settings\Admin\Pulpit\SilkroadOnline_GlobalOfficial_v1_225.exe -> [2010-01-25 17:38:45 | 1099,670,597 | ---- | C] ()
xfcodec.dll -> C:\WINDOWS\System32\xfcodec.dll -> [2010-01-22 02:33:06 | 000,041,872 | ---- | C] ()
Crysis Warhead.lnk -> C:\Documents and Settings\Admin\Pulpit\Crysis Warhead.lnk -> [2010-01-21 12:33:07 | 000,000,652 | ---- | C] ()
YouTube Downloader.lnk -> C:\Documents and Settings\Admin\Pulpit\YouTube Downloader.lnk -> [2010-01-19 22:54:59 | 000,000,804 | ---- | C] ()
Fallout Mod Manager.lnk -> C:\Documents and Settings\Admin\Pulpit\Fallout Mod Manager.lnk -> [2010-01-18 15:10:36 | 000,000,928 | ---- | C] ()
CoD RconTool.lnk -> C:\Documents and Settings\Admin\Pulpit\CoD RconTool.lnk -> [2010-01-17 11:57:32 | 000,001,617 | ---- | C] ()
Skype.lnk -> C:\Documents and Settings\All Users\Pulpit\Skype.lnk -> [2010-01-16 19:54:42 | 000,001,880 | ---- | C] ()
MRT.INI -> C:\WINDOWS\System32\MRT.INI -> [2010-01-13 17:37:37 | 000,000,118 | ---- | C] ()
PnkBstrK.sys -> C:\WINDOWS\System32\drivers\PnkBstrK.sys -> [2009-12-30 23:18:54 | 000,137,464 | ---- | C] ()
game.ini -> C:\WINDOWS\game.ini -> [2009-12-30 22:56:06 | 000,000,255 | ---- | C] ()
atksgt.sys -> C:\WINDOWS\System32\drivers\atksgt.sys -> [2009-12-06 18:07:34 | 000,281,760 | ---- | C] ()
lirsgt.sys -> C:\WINDOWS\System32\drivers\lirsgt.sys -> [2009-12-06 18:07:34 | 000,025,888 | ---- | C] ()
hplj1300.ini -> C:\WINDOWS\hplj1300.ini -> [2009-11-25 11:30:06 | 000,017,714 | ---- | C] ()
BReWErS.dll -> C:\WINDOWS\System32\BReWErS.dll -> [2009-11-22 18:47:37 | 000,005,120 | ---- | C] ()
sptd.sys -> C:\WINDOWS\System32\drivers\sptd.sys -> [2009-11-21 15:39:39 | 000,691,696 | ---- | C] ()
stci.dll -> C:\WINDOWS\System32\stci.dll -> [2009-11-21 14:27:59 | 000,005,606 | ---- | C] ()
unrar.dll -> C:\WINDOWS\System32\unrar.dll -> [2009-11-21 14:15:19 | 000,163,840 | ---- | C] ()
xvidcore.dll -> C:\WINDOWS\System32\xvidcore.dll -> [2009-11-21 14:15:18 | 000,765,952 | ---- | C] ()
x264vfw.dll -> C:\WINDOWS\System32\x264vfw.dll -> [2009-11-21 14:15:18 | 000,564,224 | ---- | C] ()
xvidvfw.dll -> C:\WINDOWS\System32\xvidvfw.dll -> [2009-11-21 14:15:18 | 000,180,224 | ---- | C] ()
qt-dx331.dll -> C:\WINDOWS\System32\qt-dx331.dll -> [2009-11-21 14:15:17 | 003,596,288 | ---- | C] ()
ff_vfw.dll -> C:\WINDOWS\System32\ff_vfw.dll -> [2009-11-21 14:15:17 | 000,007,680 | ---- | C] ()
ff_vfw.dll.manifest -> C:\WINDOWS\System32\ff_vfw.dll.manifest -> [2009-11-21 14:15:17 | 000,000,547 | ---- | C] ()
psisdecd.dll -> C:\WINDOWS\System32\psisdecd.dll -> [2009-11-21 14:00:09 | 000,354,816 | ---- | C] ()
physxcudart_20.dll -> C:\WINDOWS\System32\physxcudart_20.dll -> [2008-10-07 09:13:30 | 000,197,912 | ---- | C] ()
AgCPanelTraditionalChinese.dll -> C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll -> [2008-10-07 09:13:22 | 000,058,648 | ---- | C] ()
AgCPanelSwedish.dll -> C:\WINDOWS\System32\AgCPanelSwedish.dll -> [2008-10-07 09:13:20 | 000,058,648 | ---- | C] ()
AgCPanelSpanish.dll -> C:\WINDOWS\System32\AgCPanelSpanish.dll -> [2008-10-07 09:13:20 | 000,058,648 | ---- | C] ()
AgCPanelSimplifiedChinese.dll -> C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll -> [2008-10-07 09:13:20 | 000,058,648 | ---- | C] ()
AgCPanelPortugese.dll -> C:\WINDOWS\System32\AgCPanelPortugese.dll -> [2008-10-07 09:13:20 | 000,058,648 | ---- | C] ()
AgCPanelKorean.dll -> C:\WINDOWS\System32\AgCPanelKorean.dll -> [2008-10-07 09:13:20 | 000,058,648 | ---- | C] ()
AgCPanelJapanese.dll -> C:\WINDOWS\System32\AgCPanelJapanese.dll -> [2008-10-07 09:13:20 | 000,058,648 | ---- | C] ()
AgCPanelGerman.dll -> C:\WINDOWS\System32\AgCPanelGerman.dll -> [2008-10-07 09:13:20 | 000,058,648 | ---- | C] ()
AgCPanelFrench.dll -> C:\WINDOWS\System32\AgCPanelFrench.dll -> [2008-10-07 09:13:20 | 000,058,648 | ---- | C] ()
xlive.dll.cat -> C:\WINDOWS\System32\xlive.dll.cat -> [2007-11-26 21:56:28 | 000,151,415 | ---- | C] ()
GlobalUserInterface.CompositeFont -> C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont -> [2006-06-29 14:58:52 | 000,030,808 | ---- | C] ()
GlobalSansSerif.CompositeFont -> C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont -> [2006-06-29 14:53:56 | 000,026,489 | ---- | C] ()
GlobalSerif.CompositeFont -> C:\WINDOWS\Fonts\GlobalSerif.CompositeFont -> [2006-04-18 15:39:28 | 000,029,779 | ---- | C] ()
GlobalMonospace.CompositeFont -> C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont -> [2006-04-18 15:39:28 | 000,026,040 | ---- | C] ()
HPBHEALR.DLL -> C:\WINDOWS\System32\HPBHEALR.DLL -> [2001-07-31 09:17:12 | 000,094,274 | ---- | C] ()

[File - Lop Check]
AIMP -> C:\Documents and Settings\Admin\Dane aplikacji\AIMP -> [2010-01-08 20:36:20 | 000,000,000 | ---D | M]
Black Sea Studios -> C:\Documents and Settings\Admin\Dane aplikacji\Black Sea Studios -> [2009-12-05 11:58:02 | 000,000,000 | ---D | M]
DAEMON Tools Lite -> C:\Documents and Settings\Admin\Dane aplikacji\DAEMON Tools Lite -> [2009-11-21 18:39:56 | 000,000,000 | ---D | M]
edxLabs -> C:\Documents and Settings\Admin\Dane aplikacji\edxLabs -> [2010-01-28 14:53:02 | 000,000,000 | ---D | M]
EurekaLog -> C:\Documents and Settings\Admin\Dane aplikacji\EurekaLog -> [2010-02-12 17:29:32 | 000,000,000 | ---D | M]
OpenOffice.org -> C:\Documents and Settings\Admin\Dane aplikacji\OpenOffice.org -> [2009-11-25 11:09:48 | 000,000,000 | ---D | M]
Opera -> C:\Documents and Settings\Admin\Dane aplikacji\Opera -> [2009-11-21 14:24:29 | 000,000,000 | ---D | M]
Stardock -> C:\Documents and Settings\Admin\Dane aplikacji\Stardock -> [2009-12-06 16:27:46 | 000,000,000 | ---D | M]
Thinstall -> C:\Documents and Settings\Admin\Dane aplikacji\Thinstall -> [2010-01-24 17:12:34 | 000,000,000 | ---D | M]
uTorrent -> C:\Documents and Settings\Admin\Dane aplikacji\uTorrent -> [2010-02-09 13:11:06 | 000,000,000 | ---D | M]
BioWare -> C:\Documents and Settings\All Users\Dane aplikacji\BioWare -> [2009-11-25 15:51:34 | 000,000,000 | ---D | M]
DAEMON Tools Lite -> C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite -> [2009-11-21 15:39:14 | 000,000,000 | ---D | M]
ESET -> C:\Documents and Settings\All Users\Dane aplikacji\ESET -> [2009-11-21 14:37:42 | 000,000,000 | ---D | M]
Firefly Studios -> C:\Documents and Settings\All Users\Dane aplikacji\Firefly Studios -> [2009-12-26 19:45:04 | 000,000,000 | ---D | M]
salvation -> C:\Documents and Settings\All Users\Dane aplikacji\salvation -> [2009-12-29 19:32:15 | 000,000,000 | ---D | M]
Stardock -> C:\Documents and Settings\All Users\Dane aplikacji\Stardock -> [2009-12-06 16:26:47 | 000,000,000 | ---D | M]
{CE40276A-3E8A-4094-86F7-5932CAEFAFB9} -> C:\Documents and Settings\All Users\Dane aplikacji\{CE40276A-3E8A-4094-86F7-5932CAEFAFB9} -> [2009-12-06 16:26:56 | 000,000,000 | -H-D | M]
Scheduled Update for Ask Toolbar.job -> C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job -> [2010-02-14 20:01:00 | 000,000,234 | ---- | M] ()
{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job -> C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job -> [2010-02-14 19:56:00 | 000,000,240 | -H-- | M] ()
{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job -> C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job -> [2010-02-14 20:05:00 | 000,000,278 | -H-- | M] ()

[File - Purity Scan]

< End of report >


Tak jak w temacie komp muli, wszystkie programy długo się ladują, internet muli.

[wojtas]

Daj loga z OTL

[Decoy]

Kod: Zaznacz wszystko

OTL logfile created on: 2010-02-14 20:21:47 - Run 1
OTL by OldTimer - Version 3.1.28.0     Folder = C:\Documents and Settings\Admin\Pulpit
Windows XP Home Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 64,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 81,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 6,84 Gb Free Space | 14,02% Space Free | Partition Type: NTFS
Drive D: | 184,05 Gb Total Space | 33,44 Gb Free Space | 18,17% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
Drive F: | 298,09 Gb Total Space | 3,47 Gb Free Space | 1,16% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: BLACKDEVIL
Current User Name: Admin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2010-02-14 20:20:53 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Admin\Pulpit\OTL.exe
PRC - [2010-02-12 17:22:38 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2010-02-06 12:52:24 | 000,214,520 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exe
PRC - [2009-12-30 23:18:39 | 000,075,064 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe
PRC - [2009-12-19 20:46:51 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009-12-19 20:46:51 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2009-11-20 19:01:18 | 000,832,296 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe
PRC - [2009-11-17 15:18:22 | 006,828,032 | ---- | M] () -- C:\Program Files\WapSter\WapSter AQQ\AQQ.exe
PRC - [2009-11-16 09:04:30 | 000,735,960 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2009-11-16 09:03:32 | 002,054,360 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2009-10-30 12:57:08 | 000,369,200 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\DTLite.exe
PRC - [2009-10-16 10:44:18 | 000,053,560 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Tools\InCD\NBHRegInCDSrv.exe
PRC - [2009-10-16 10:44:10 | 001,420,592 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Tools\InCD\InCDSrv.exe
PRC - [2008-06-24 14:58:41 | 000,557,056 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe
PRC - [2008-02-13 07:31:34 | 016,857,600 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.exe
PRC - [2007-07-17 11:13:56 | 000,049,152 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
PRC - [2007-07-17 11:13:34 | 000,049,152 | ---- | M] (ATI Technologies Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
PRC - [2004-08-06 09:45:04 | 000,877,568 | ---- | M] (THOMSON Telecom Belgium) -- C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe


[color=#E56717]========== Modules (SafeList) ==========[/color]

MOD - [2010-02-14 20:20:53 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Admin\Pulpit\OTL.exe


[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - [2010-02-12 17:22:51 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2010-02-12 17:22:49 | 000,020,480 | ---- | M] (BioWare) [On_Demand | Stopped] -- D:\gry\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe -- (DAUpdaterSvc)
SRV - [2010-02-06 12:52:24 | 000,214,520 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\PnkBstrB.exe -- (PnkBstrB)
SRV - [2009-12-30 23:18:39 | 000,075,064 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA)
SRV - [2009-12-19 20:46:51 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009-11-24 22:19:47 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009-11-16 09:12:54 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EHttpSrv)
SRV - [2009-11-16 09:04:30 | 000,735,960 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2009-10-16 10:44:18 | 000,053,560 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Tools\InCD\NBHRegInCDSrv.exe -- (NeroRegInCDSrv)
SRV - [2009-10-16 10:44:10 | 001,420,592 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Tools\InCD\InCDSrv.exe -- (InCDSrv)
SRV - [2008-06-24 14:58:41 | 000,557,056 | ---- | M] (ATI Technologies Inc.) [Auto | Running] -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller)
SRV - [2002-08-01 10:22:40 | 000,065,536 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\hpzipm12.exe -- (Pml Driver HPZ12)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2009-12-06 18:07:34 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2009-12-06 18:07:34 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009-11-21 15:39:39 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009-11-21 13:50:06 | 000,016,608 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2009-11-16 09:06:50 | 000,096,408 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdir.sys -- (epfwtdir)
DRV - [2009-11-16 09:03:36 | 000,108,792 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2009-11-16 08:56:12 | 000,116,520 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)
DRV - [2009-10-16 10:43:04 | 000,130,200 | ---- | M] (Nero AG) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\InCDFs.sys -- (InCDFs)
DRV - [2009-10-16 10:42:58 | 000,019,096 | ---- | M] (Nero AG) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\InCDRec.sys -- (InCDRec)
DRV - [2009-10-16 10:42:50 | 000,048,280 | ---- | M] (Nero AG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\InCDPass.sys -- (InCDPass)
DRV - [2008-08-14 07:57:42 | 000,074,720 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\adfs.sys -- (adfs)
DRV - [2008-06-24 15:52:46 | 003,229,696 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008-05-20 12:53:36 | 000,093,696 | R--- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2008-04-15 13:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008-04-15 13:00:00 | 000,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv)
DRV - [2008-04-15 13:00:00 | 000,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink)
DRV - [2008-02-14 10:04:06 | 004,676,096 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2003-12-08 12:53:48 | 000,053,600 | ---- | M] (THOMSON) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcan5wn.sys -- (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN)
DRV - [2003-12-08 12:53:46 | 000,070,688 | ---- | M] (THOMSON) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcaudsl.sys -- (alcaudsl)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1844237615-152049171-1801674531-1004\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1844237615-152049171-1801674531-1004\S-1-5-21-1844237615-152049171-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010-02-14 20:00:21 | 000,000,000 | ---D | M]

[2010-02-09 18:40:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Extensions
[2009-12-30 22:52:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\extensions
[2009-12-30 22:52:45 | 000,000,000 | ---D | M] (XfireXO Toolbar) -- C:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}

O1 HOSTS File: ([2009-11-24 22:28:54 | 000,001,224 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 127.0.0.1            activate.adobe.com
O1 - Hosts: 127.0.0.1            practivate.adobe.com
O1 - Hosts: 127.0.0.1            ereg.adobe.com
O1 - Hosts: 127.0.0.1            activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1            wip3.adobe.com
O1 - Hosts: 127.0.0.1            3dns-3.adobe.com
O1 - Hosts: 127.0.0.1            3dns-2.adobe.com
O1 - Hosts: 127.0.0.1            adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1            adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1            adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1            ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1            activate-sea.adobe.com
O1 - Hosts: 127.0.0.1            wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1            activate-sjc0.adobe.com
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (no name) -  - No CLSID value found.
O3 - HKLM\..\Toolbar: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKU\S-1-5-21-1844237615-152049171-1801674531-1004\..\Toolbar\WebBrowser: (XfireXO Toolbar) - {5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-1844237615-152049171-1801674531-1004\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe (THOMSON Telecom Belgium)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKU\S-1-5-21-1844237615-152049171-1801674531-1004..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1844237615-152049171-1801674531-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-11-21 13:38:26 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - Unable to obtain root file information for disk D:\
O32 - Unable to obtain root file information for disk F:\
O33 - MountPoints2\{7029fef9-f2c8-11de-8f47-000e501dc860}\Shell - "" = AutoRun
O33 - MountPoints2\{7029fef9-f2c8-11de-8f47-000e501dc860}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found
O33 - MountPoints2\{7029fefa-f2c8-11de-8f47-000e501dc860}\Shell\AutoRun\command - "" = JAN\J-1-2-34-000000AAAA-11111111111-5555555555-111\Max.exe
O33 - MountPoints2\{7029fefa-f2c8-11de-8f47-000e501dc860}\Shell\open\command - "" = JAN\J-1-2-34-000000AAAA-11111111111-5555555555-111\Max.exe
O33 - MountPoints2\{741fbea9-e42c-11de-8f23-000e501dc860}\Shell - "" = AutoRun
O33 - MountPoints2\{741fbea9-e42c-11de-8f23-000e501dc860}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found
O33 - MountPoints2\{911f9722-faeb-11de-8f5a-000e501dc860}\Shell\Open(&0)\command - "" = H:\Recycled\ctfmon.exe -- File not found
O33 - MountPoints2\{a7fc56a6-02bc-11df-8f71-000e501dc860}\Shell\AutoRun\command - "" = SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe
O33 - MountPoints2\{a7fc56a6-02bc-11df-8f71-000e501dc860}\Shell\open\command - "" = SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe
O33 - MountPoints2\{b4878d6e-e374-11de-8f22-000e501dc860}\Shell\AutoRun\command - "" = F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found
O33 - MountPoints2\{b4878d6e-e374-11de-8f22-000e501dc860}\Shell\open\command - "" = F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found
O33 - MountPoints2\{b50c2f93-e67d-11de-8f2f-000e501dc860}\Shell\AutoRun\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found
O33 - MountPoints2\{b50c2f93-e67d-11de-8f2f-000e501dc860}\Shell\open\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found
O33 - MountPoints2\{bcf15952-de3c-11de-8f15-000e501dc860}\Shell\Open(&0)\command - "" = H:\Recycled\ctfmon.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2010-02-14 20:20:53 | 000,549,376 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Admin\Pulpit\OTL.exe
[2010-02-14 20:11:25 | 000,632,320 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Admin\Pulpit\OTS.exe
[2010-02-14 20:00:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2010-02-14 20:00:20 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2010-02-12 17:14:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
[2010-02-01 14:25:37 | 000,000,000 | ---D | C] -- C:\Program Files\Port Royale
[2010-01-29 22:46:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Pulpit\100CANON
[2010-01-29 12:29:06 | 000,000,000 | ---D | C] -- C:\Program Files\I-bot ocx files fix
[2010-01-28 14:53:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Dane aplikacji\edxLabs
[2010-01-24 17:12:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Dane aplikacji\Thinstall
[2010-01-19 22:54:59 | 000,000,000 | ---D | C] -- C:\Program Files\YouTube Downloader
[2010-01-18 14:51:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Dane aplikacji\InstallShield Installation Information
[2010-01-17 11:57:30 | 000,209,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\TABCTL32.OCX
[2010-01-17 11:57:29 | 002,271,152 | ---- | C] (Codejock Software) -- C:\WINDOWS\System32\Codejock.CommandBars.Unicode.v12.1.1.ocx
[2010-01-17 11:57:29 | 000,109,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSWINSCK.OCX
[2010-01-17 11:57:27 | 001,779,632 | ---- | C] (Codejock Software) -- C:\WINDOWS\System32\Codejock.Controls.v12.1.1.ocx
[2010-01-17 11:57:26 | 000,000,000 | ---D | C] -- C:\Program Files\CoD RconTool
[2010-01-17 11:38:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\AskToolbar
[2010-01-16 19:55:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Dane aplikacji\Skype
[2010-01-16 19:54:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2010-01-16 19:54:39 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2010-01-16 19:54:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Skype
[2010-01-06 18:46:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Xfire
[2009-11-21 14:50:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\ESET
[2009-11-21 13:40:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft
[2009-11-21 13:40:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft
[2009-11-21 13:38:24 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft
[2009-11-21 13:38:24 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2010-02-14 20:20:53 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Admin\Pulpit\OTL.exe
[2010-02-14 20:11:25 | 000,632,320 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Admin\Pulpit\OTS.exe
[2010-02-14 20:05:00 | 000,000,278 | -H-- | M] () -- C:\WINDOWS\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
[2010-02-14 20:01:00 | 000,000,234 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010-02-14 19:56:00 | 000,000,240 | -H-- | M] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010-02-14 19:10:23 | 000,000,290 | ---- | M] () -- C:\WINDOWS\system.ini
[2010-02-14 19:01:00 | 000,017,878 | -H-- | M] () -- C:\WINDOWS\System32\vcmgcd32.dl_
[2010-02-14 14:40:04 | 001,087,636 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010-02-14 14:40:04 | 000,490,284 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2010-02-14 14:40:04 | 000,432,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010-02-14 14:40:04 | 000,083,660 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2010-02-14 14:40:04 | 000,067,312 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010-02-14 14:36:02 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010-02-14 14:35:53 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010-02-14 13:39:35 | 003,932,160 | -H-- | M] () -- C:\Documents and Settings\Admin\NTUSER.DAT
[2010-02-14 13:39:35 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\Admin\ntuser.ini
[2010-02-14 12:07:00 | 034,372,096 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\eav_nt32_plk.msi
[2010-02-13 22:12:19 | 000,874,355 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\pictures_longcat.jpg
[2010-02-13 18:03:20 | 000,000,659 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\AIMP2.lnk
[2010-02-12 17:59:58 | 002,808,832 | R--- | M] (RealTek Semicoductor Corp.) -- C:\WINDOWS\alcwzrd.exe
[2010-02-12 17:59:58 | 000,045,056 | ---- | M] (Northern Codeworks) -- C:\WINDOWS\NCUNINST.EXE
[2010-02-12 17:32:09 | 000,000,779 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\AQQ.lnk
[2010-02-12 17:24:03 | 000,028,672 | ---- | M] () -- C:\WINDOWS\System32\userini.exe
[2010-02-12 17:22:52 | 000,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\ieudinit.exe
[2010-02-12 17:22:38 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
[2010-02-12 17:20:50 | 000,070,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ie4uinit.exe
[2010-02-12 17:20:41 | 000,070,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\ie4uinit.exe
[2010-02-12 16:51:13 | 000,098,313 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\aaa.jpg
[2010-02-11 16:50:00 | 021,390,666 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\strzegomskie-kurewki-zwierzenia.wmv
[2010-02-10 21:31:26 | 026,476,031 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\jinsi.zip
[2010-02-10 21:28:35 | 000,000,568 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\Loader.lnk
[2010-02-10 21:24:48 | 000,000,474 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\iBot.lnk
[2010-02-10 21:23:42 | 000,000,518 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\Silkroad.lnk
[2010-02-10 20:35:04 | 000,015,360 | ---- | M] () -- C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010-02-10 19:09:04 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010-02-10 19:09:01 | 000,000,118 | ---- | M] () -- C:\WINDOWS\System32\MRT.INI
[2010-02-10 18:32:16 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010-02-08 16:34:21 | 000,000,467 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\Airfix Dogfighter.lnk
[2010-02-07 10:59:22 | 000,021,345 | ---- | M] () -- C:\Documents and Settings\Admin\Moje dokumenty\Bogusz.pit
[2010-02-06 12:52:52 | 000,137,464 | ---- | M] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010-02-06 12:52:24 | 000,214,520 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.xtr
[2010-02-06 12:52:24 | 000,214,520 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.exe
[2010-02-05 20:16:07 | 000,035,558 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\1265397233_by_AdventRebel_500.jpg
[2010-02-05 20:12:14 | 000,033,575 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\om nom nom nom.jpg
[2010-02-02 21:58:00 | 732,948,480 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\Surrogates.avi
[2010-02-02 15:14:53 | 000,028,482 | ---- | M] () -- C:\Documents and Settings\Admin\Moje dokumenty\FLORIAN.pit
[2010-02-01 14:27:21 | 000,001,564 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\Port Royale.lnk
[2010-01-31 14:43:31 | 000,031,135 | ---- | M] () -- C:\Documents and Settings\Admin\Moje dokumenty\raf.pit
[2010-01-29 15:09:19 | 000,379,752 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\tut.JPG
[2010-01-26 12:15:53 | 000,000,822 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\RISEN_Mini_MaDBoT.lnk
[2010-01-22 22:30:19 | 000,001,617 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\CoD RconTool.lnk
[2010-01-22 02:33:06 | 000,041,872 | ---- | M] () -- C:\WINDOWS\System32\xfcodec.dll
[2010-01-21 12:33:45 | 000,107,888 | ---- | M] (Sony DADC Austria AG.) -- C:\WINDOWS\System32\CmdLineExt.dll
[2010-01-21 12:33:07 | 000,000,652 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\Crysis Warhead.lnk
[2010-01-19 22:54:59 | 000,000,804 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\YouTube Downloader.lnk
[2010-01-18 15:10:36 | 000,000,928 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\Fallout Mod Manager.lnk
[2010-01-16 19:54:42 | 000,001,880 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2010-02-14 12:04:07 | 034,372,096 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\eav_nt32_plk.msi
[2010-02-13 22:12:19 | 000,874,355 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\pictures_longcat.jpg
[2010-02-12 14:50:27 | 000,098,313 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\aaa.jpg
[2010-02-11 21:36:04 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\userini.exe
[2010-02-11 16:46:10 | 021,390,666 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\strzegomskie-kurewki-zwierzenia.wmv
[2010-02-10 21:27:00 | 026,476,031 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\jinsi.zip
[2010-02-10 21:24:49 | 000,000,474 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\iBot.lnk
[2010-02-10 21:24:44 | 000,000,568 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\Loader.lnk
[2010-02-08 19:58:08 | 733,898,752 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\the kingdom pl.avi
[2010-02-08 19:57:48 | 732,948,480 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\Surrogates.avi
[2010-02-08 16:34:21 | 000,000,467 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\Airfix Dogfighter.lnk
[2010-02-07 10:59:22 | 000,021,345 | ---- | C] () -- C:\Documents and Settings\Admin\Moje dokumenty\Bogusz.pit
[2010-02-05 20:16:07 | 000,035,558 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\1265397233_by_AdventRebel_500.jpg
[2010-02-05 20:12:14 | 000,033,575 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\om nom nom nom.jpg
[2010-02-01 14:27:21 | 000,001,564 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\Port Royale.lnk
[2010-01-31 14:52:31 | 000,028,482 | ---- | C] () -- C:\Documents and Settings\Admin\Moje dokumenty\FLORIAN.pit
[2010-01-31 14:43:31 | 000,031,135 | ---- | C] () -- C:\Documents and Settings\Admin\Moje dokumenty\raf.pit
[2010-01-29 15:09:19 | 000,379,752 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\tut.JPG
[2010-01-26 12:15:54 | 000,000,822 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\RISEN_Mini_MaDBoT.lnk
[2010-01-25 18:02:34 | 000,000,518 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\Silkroad.lnk
[2010-01-25 17:38:45 | 1099,670,597 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\SilkroadOnline_GlobalOfficial_v1_225.exe
[2010-01-22 02:33:06 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll
[2010-01-21 12:33:07 | 000,000,652 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\Crysis Warhead.lnk
[2010-01-19 22:54:59 | 000,000,804 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\YouTube Downloader.lnk
[2010-01-18 15:10:36 | 000,000,928 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\Fallout Mod Manager.lnk
[2010-01-17 11:57:32 | 000,001,617 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\CoD RconTool.lnk
[2010-01-16 19:54:42 | 000,001,880 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk
[2010-01-13 17:37:37 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2009-12-30 23:18:54 | 000,137,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009-12-30 22:56:06 | 000,000,255 | ---- | C] () -- C:\WINDOWS\game.ini
[2009-12-06 18:07:34 | 000,281,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2009-12-06 18:07:34 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2009-11-25 11:30:06 | 000,017,714 | ---- | C] () -- C:\WINDOWS\hplj1300.ini
[2009-11-22 18:47:37 | 000,005,120 | ---- | C] () -- C:\WINDOWS\System32\BReWErS.dll
[2009-11-21 20:26:37 | 000,015,360 | ---- | C] () -- C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-11-21 15:39:39 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009-11-21 14:27:59 | 000,005,606 | ---- | C] () -- C:\WINDOWS\System32\stci.dll
[2009-11-21 14:15:19 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009-11-21 14:15:18 | 000,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009-11-21 14:15:18 | 000,564,224 | ---- | C] () -- C:\WINDOWS\System32\x264vfw.dll
[2009-11-21 14:15:18 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009-11-21 14:15:17 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2009-11-21 14:15:17 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009-11-21 14:15:17 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009-11-21 14:00:09 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2008-10-07 09:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2008-10-07 09:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008-10-07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008-10-07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008-10-07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008-10-07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008-10-07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2008-10-07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008-10-07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2008-10-07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2007-11-26 21:56:28 | 000,151,415 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2001-07-31 09:17:12 | 000,094,274 | ---- | C] () -- C:\WINDOWS\System32\HPBHEALR.DLL

[color=#E56717]========== LOP Check ==========[/color]

[2010-01-08 20:36:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\AIMP
[2009-12-05 11:58:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\Black Sea Studios
[2009-11-21 18:39:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\DAEMON Tools Lite
[2010-01-28 14:53:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\edxLabs
[2010-02-12 17:29:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\EurekaLog
[2009-11-25 11:09:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\OpenOffice.org
[2009-11-21 14:24:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\Opera
[2009-12-06 16:27:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\Stardock
[2010-01-24 17:12:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\Thinstall
[2010-02-09 13:11:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\uTorrent
[2009-11-25 15:51:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\BioWare
[2009-11-21 15:39:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite
[2009-11-21 14:37:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ESET
[2009-12-26 19:45:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Firefly Studios
[2009-12-29 19:32:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\salvation
[2009-12-06 16:26:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Stardock
[2009-12-06 16:26:56 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\{CE40276A-3E8A-4094-86F7-5932CAEFAFB9}
[2010-02-14 20:01:00 | 000,000,234 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
[2010-02-14 19:56:00 | 000,000,240 | -H-- | M] () -- C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010-02-14 20:05:00 | 000,000,278 | -H-- | M] () -- C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job

[color=#E56717]========== Purity Check ==========[/color]


< End of report >


[wojtas]

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKU\S-1-5-21-1844237615-152049171-1801674531-1004\..\Toolbar\WebBrowser: (XfireXO Toolbar) - {5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-1844237615-152049171-1801674531-1004\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O32 - Unable to obtain root file information for disk D:\
O32 - Unable to obtain root file information for disk F:\
O33 - MountPoints2\{7029fef9-f2c8-11de-8f47-000e501dc860}\Shell - "" = AutoRun
O33 - MountPoints2\{7029fef9-f2c8-11de-8f47-000e501dc860}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found
O33 - MountPoints2\{7029fefa-f2c8-11de-8f47-000e501dc860}\Shell\AutoRun\command - "" = JAN\J-1-2-34-000000AAAA-11111111111-5555555555-111\Max.exe
O33 - MountPoints2\{7029fefa-f2c8-11de-8f47-000e501dc860}\Shell\open\command - "" = JAN\J-1-2-34-000000AAAA-11111111111-5555555555-111\Max.exe
O33 - MountPoints2\{741fbea9-e42c-11de-8f23-000e501dc860}\Shell - "" = AutoRun
O33 - MountPoints2\{741fbea9-e42c-11de-8f23-000e501dc860}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found
O33 - MountPoints2\{911f9722-faeb-11de-8f5a-000e501dc860}\Shell\Open(&0)\command - "" = H:\Recycled\ctfmon.exe -- File not found
O33 - MountPoints2\{a7fc56a6-02bc-11df-8f71-000e501dc860}\Shell\AutoRun\command - "" = SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe
O33 - MountPoints2\{a7fc56a6-02bc-11df-8f71-000e501dc860}\Shell\open\command - "" = SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\system32.exe
O33 - MountPoints2\{b4878d6e-e374-11de-8f22-000e501dc860}\Shell\AutoRun\command - "" = F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found
O33 - MountPoints2\{b4878d6e-e374-11de-8f22-000e501dc860}\Shell\open\command - "" = F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found
O33 - MountPoints2\{b50c2f93-e67d-11de-8f2f-000e501dc860}\Shell\AutoRun\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found
O33 - MountPoints2\{b50c2f93-e67d-11de-8f2f-000e501dc860}\Shell\open\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found
O33 - MountPoints2\{bcf15952-de3c-11de-8f15-000e501dc860}\Shell\Open(&0)\command - "" = H:\Recycled\ctfmon.exe -- File not found


:Files
C:\WINDOWS\System32\userini.exe
C:\WINDOWS\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
C:\Program Files\Ask.com
C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\AskToolbar

:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]

Kliknij w Run Fix. I potwierdz reset kompa

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (zaktualizuj, usuń co znajdzie ) i daj raport ze skanu

[Decoy]

Kod: Zaznacz wszystko

Malwarebytes' Anti-Malware 1.44
Wersja bazy definicji: 3739
Windows 5.1.2600 Dodatek Service Pack 3
Internet Explorer 7.0.5730.13

2010-02-14 22:32:59
mbam-log-2010-02-14 (22-32-59).txt

Typ skanowania: Pełne skanowanie (C:\|D:\|F:\|)
Przeskanowane obiekty: 227871
Upłynęło: 31 minute(s), 4 second(s)

Zainfekowane procesy w pamięci: 0
Zainfekowane moduły pamięci: 1
Zainfekowane klucze rejestru: 7
Zainfekowane wartości rejestru: 0
Zainfekowane pliki rejestru: 0
Zainfekowane foldery: 1
Zainfekowane pliki: 15

Zainfekowane procesy w pamięci:
(Nie wykryto groźnych plików)

Zainfekowane moduły pamięci:
C:\WINDOWS\system32\vcmgcd32.dll (Virus.Sality) -> Delete on reboot.

Zainfekowane klucze rejestru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{88abc5c0-4fcb-11bb-aax5-81cx1c635612} (Generic.Bot.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{88abc5c0-4fcb-11bb-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Astrocom (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\NeoChronos (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.

Zainfekowane wartości rejestru:
(Nie wykryto groźnych plików)

Zainfekowane pliki rejestru:
(Nie wykryto groźnych plików)

Zainfekowane foldery:
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 (Trojan.Agent) -> Quarantined and deleted successfully.

Zainfekowane pliki:
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe (Generic.Bot.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vcmgcd32.dll (Virus.Sality) -> Delete on reboot.
C:\autorun.inf (Trojan.VB) -> Quarantined and deleted successfully.
C:\Recycled\ctfmon.exe (Trojan.VB) -> Quarantined and deleted successfully.
C:\Recycled\Recycled\ctfmon.exe (Trojan.VB) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-1844237615-152049171-1801674531-1004\Dc125.exe (Trojan.VB) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\nod17.tmp (Virus.Sality) -> Delete on reboot.
C:\_OTL\MovedFiles\02142010_211117\C_WINDOWS\System32\userini.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
D:\Recycled\ctfmon.exe (Trojan.VB) -> Quarantined and deleted successfully.
F:\Recycled\ctfmon.exe (Trojan.VB) -> Quarantined and deleted successfully.
F:\System Volume Information\_restore{3725539A-7BEE-4A06-9ECA-AC0D4C7F9AB5}\RP133\A0030288.exe (Trojan.VB) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vcmgcd32.dl_ (Virus.Sality) -> Quarantined and deleted successfully.
C:\WINDOWS\msa.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sshnas.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.


Nod32 dalej krzyczy ze jest pełno plików zainfekowanych win32/sality.naj

[wojtas]

niestety lipa.. poczytaj o sality tutaj:

http://www.searchengines.pl/Infekcje-plikow-wykonywalnych-exe-dll-scr-t122692.html

spróbuj zastosować metodę czyszczenia z zewnątrz..

[Decoy]

Czyli w sumie najprostszym rozwiązaniem będzie format?

[wojtas]

sadzę że tak .. wszystkie partycje.. możesz muze filmy sobie zostawić.. zadnych plików exe, dll, scr.